EUVD-2026-31588
GHSA-r6mh-xmgq-5898
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Edimax BR-6675nD 1.12. This affects the function formHwSet of the file /goform/formHwSet of the component POST Request Handler. The manipulation of the argument regDomain/ABandregDomain/nic0Addr/nic1Addr/wlanAddr/inicAddr results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Command injection in the Edimax BR-6675nD firmware 1.12 exposes the POST handler at /goform/formHwSet to OS-level command execution through multiple unsanitized parameters including regulatory domain and MAC address fields. Remote attackers holding low-privilege credentials can exploit this without user interaction, as confirmed by a publicly released proof-of-concept. The vendor was notified prior to disclosure but did not respond, leaving no official patch and no coordinated remediation path.
Technical ContextAI
CWE-77 (Improper Neutralization of Special Elements Used in a Command) describes the root cause: user-supplied input is passed directly into OS command construction without adequate sanitization within the formHwSet function. The affected endpoint /goform/formHwSet processes POST requests for hardware-level device configuration - specifically wireless regulatory domain settings (regDomain, ABandregDomain) and MAC address fields for multiple network interfaces (nic0Addr, nic1Addr, wlanAddr, inicAddr). On embedded networking devices such as routers, these goform-style handlers typically interface with firmware-level CLI commands or shell wrappers. The CPE identifier cpe:2.3:a:edimax:br-6675nd (with wildcard version) covers the Edimax BR-6675nD product family; only version 1.12 is explicitly confirmed affected per ENISA EUVD-2026-31588.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor failed to respond to coordinated disclosure, making an official fix unlikely in the near term. The primary compensating control is to immediately remove the device's web management interface from any internet-facing exposure - block external access to the administrative web UI (typically TCP 80/443) at the perimeter firewall or upstream router. Restrict management access to a dedicated, isolated management VLAN or trusted internal subnet only, accepting the trade-off of reduced management flexibility. Ensure all default administrative credentials are changed, as the PR:L requirement means any low-privilege account credential fulfills the exploitation precondition. If this device is deployed in a security-sensitive role or handles internet-facing traffic, consider replacement with an actively maintained and vendor-supported device. The public POC documented at https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6675nD-formHwSet-34b53a41781f8077b588f6e7cbbed36b can assist defenders in confirming whether a specific deployment is exploitable in their environment.
Stack/heap buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows authenticated remote attackers to corrupt
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router's web management interface allows remote attackers with low
Stack buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote authenticated attackers to corrupt memo
Stack buffer overflow in the Edimax BR-6675nD 1.12 router's PPTP setup handler allows remote authenticated attackers to
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote attackers to corrupt memory by sending a mali
Stack/heap buffer overflow in Edimax BR-6675nD 1.12 routers allows authenticated remote attackers to corrupt memory via
Command injection in the Edimax BR-6675nD 1.12 router's WPS start handler allows remote attackers with low-privilege aut
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows a low-privileged remote attacker
Command injection in Edimax BR-6675nD 1.12 router firmware allows authenticated remote attackers to execute arbitrary OS
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows remote authenticated attackers t
Command injection in Edimax BR-6675nD firmware 1.12 enables remote attackers with administrative credentials to execute
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today